Skip to content

fix(plugin-interactive-tools): add --no-time-gate support to upgrade-interactive (#7207) - #7257

Open
Ayush442842q wants to merge 2 commits into
yarnpkg:masterfrom
Ayush442842q:fix/upgrade-interactive-no-time-gate-7207
Open

fix(plugin-interactive-tools): add --no-time-gate support to upgrade-interactive (#7207)#7257
Ayush442842q wants to merge 2 commits into
yarnpkg:masterfrom
Ayush442842q:fix/upgrade-interactive-no-time-gate-7207

Conversation

@Ayush442842q

@Ayush442842q Ayush442842q commented Aug 12, 2026 •
edited
Loading

Copy link
Copy Markdown

What's the problem this PR addresses?

In Yarn 4.17.0, npmMinimalAgeGate default was set to 1d. While commands like yarn add and yarn up received --no-time-gate support to bypass age gate restrictions during package resolution, yarn upgrade-interactive did not support --no-time-gate or disable time gates during candidate version lookups.

As a result:

  1. yarn upgrade-interactive failed to resolve and display available package upgrades when candidate versions fell within the age gate period or when registries/scope configs lacked publish timestamp metadata.
  2. Because upgrade-interactive filters out packages when no newer candidate version is found (suggestions.length <= 1), out-of-date packages were hidden completely from the interactive menu.

Closes #7207

How did you fix it?

  1. Added --no-time-gate flag to yarn upgrade-interactive:
    Updated UpgradeInteractiveCommand in packages/plugin-interactive-tools/sources/commands/upgrade-interactive.tsx to accept the --no-time-gate option and invoke suggestUtils.disableTimeGate(configuration) when specified.

  2. Bypassed age gate when publishTimes metadata is absent:
    Updated shouldBeQuarantined in packages/plugin-npm/sources/npmConfigUtils.ts to ensure npmMinimalAgeGate is bypassed if publishTimes metadata is missing (e.g. custom or scope registries like GitHub Packages/Artifactory).

  3. Added Acceptance Tests:
    Added test coverage in packages/acceptance-tests/pkg-tests-specs/sources/features/npmMinimalAgeGate.test.ts for packages without release time metadata.

Checklist

  • I have read the Contributing Guide.
  • I have set the packages that need to be released for my changes to be effective.
  • I will check that all automated PR checks pass before the PR gets reviewed.

@Ayush442842q
Ayush442842q force-pushed the fix/upgrade-interactive-no-time-gate-7207 branch from cb04640 to 535733b Compare August 12, 2026 19:52
@arcanis arcanis mentioned this pull request Aug 14, 2026
Merged
2 tasks
arcanis added a commit to yarnpkg/zpm that referenced this pull request Aug 15, 2026
@arcanis
Backports various fixes and tests from Berry (#327)
8be5add 
## What's the problem this PR addresses?

A review of recent Berry PRs identified several fixes and regression
tests that also apply to zpm. This PR backports them in one batch.

## How did I fix it?

**Bug fixes (the ported regression tests reproduced each of these before
the fix):**

- yarnpkg/berry#7205 — `*` now resolves to prereleases when a package
has no stable version. The fallback only applies to a literal `*` range
(not the internal `>=0.0.0-0` any-range), and `--check-resolutions`
accepts the resulting prerelease pins.
- yarnpkg/berry#7216 — the nm linker now prefers direct dependency
binaries over transitively-hoisted aliases when two packages expose the
same bin name, instead of resolving collisions by ident order.
- yarnpkg/berry#7209 — commands that need an npm OTP now fail with a
`--otp` hint when not attached to an interactive terminal, instead of
blocking forever on a prompt.
- yarnpkg/berry#7255 — `yarn npm audit --recursive --environment
production` no longer reports advisories only reachable through a nested
workspace's devDependencies.
- yarnpkg/berry#7253 — `yarn info --virtuals` now reports base
descriptors alongside virtual locators (zpm had the mirror image of
Berry's bug: correct locators, virtualized descriptors).
- yarnpkg/berry#7206 — a failed Algolia auto-types lookup no longer
aborts `yarn add`; it degrades to a warning (with the `enableAutoTypes`
escape hatch) and the lookup is bounded by a 10s per-request timeout.

**Feature:**

- yarnpkg/berry#7243 — `supportedArchitectures` additionally accepts a
list of explicit os/cpu/libc combinations (matched per-entry, no
cross-product), with the same config syntax as Berry.

**Tests only (zpm's behavior was already correct):**

- yarnpkg/berry#7250 / yarnpkg/berry#7257 — gate bypass for packages
without release-time metadata, plus the `no-time-deps` fixture and
registry-mock support.
- yarnpkg/berry#7214 — scoped-gate inheritance tests, adapted to zpm's
`packageRules`/`sourceRules` model (zpm's Option-based overrides make
Berry's default-shadowing bug structurally impossible).

**Artifact sync:**

- Re-ran `scripts/import-artifacts.mjs` against Berry master, picking up
yarnpkg/berry#7232 and the extensions hunk of yarnpkg/berry#7228 (8 new
package extensions: 5 Volar `typescript` peers,
`vite-plugin-vue-devtools`, 2 Parcel entries) along with forward-only
PnP hook/patch updates.

## Checklist

- [x] I have read the [Contributing
Guide](https://yarnpkg.com/advanced/contributing).
- [x] I have checked that all the impacted tests pass: the touched
acceptance suites (npmMinimalAgeGate, prunedNativeDeps, protocols/npm,
npm/audit, info, publish, node-modules, packageExtensions,
checkResolutions, add) pass 215/218 (3 skipped), plus `cargo test` for
zpm-config (7) and zpm-semver (108). The only remaining local failures
reproduce identically on a pristine `main` build (venv/Python
environment, one live-Algolia-data test, `path_iterators` and two
lazyInstalls focus-coverage tests).

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Touches core install resolution, architecture filtering, and audit
traversal; behavior changes are intentional but affect many installs and
multi-arch fetches.
> 
> **Overview**
> Backports a batch of Berry fixes and tests into zpm, covering install
resolution, CLI behavior, configuration, and artifact sync.
> 
> **Resolution & install:** Literal `*` ranges can resolve to
prereleases when no stable versions exist, with matching
`--check-resolutions` acceptance. Algolia auto-`@types` lookup is capped
at 10s, warns instead of failing `yarn add`, and respects
`enableAutoTypes`. HTTP requests gain a per-request `.timeout()` bounded
by `httpTimeout`.
> 
> **Commands & linkers:** `npm publish` errors with a `--otp` hint when
not on an interactive TTY. Recursive production `npm audit` skips nested
workspaces’ devDependencies. `yarn info --virtuals` shows physical
descriptors with virtual locators. Node-modules bin symlinks prefer
direct dependencies over hoisted aliases.
> 
> **`supportedArchitectures`:** Schema becomes a `oneOrMany` list of
entries with `ArchitectureFilter` fields (`null` = any). Legacy
single-object YAML still works; project config replaces (not merges)
user entries. Matching uses `SystemSet` / `supported_systems()` with
per-entry validation instead of a flat cross-product of all systems.
> 
> **Artifacts:** `builtin-extensions.json` gains Volar, Vite devtools,
and Parcel peer entries; package manager pin updated.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
4aaf6a1. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Bug?]: yarn upgrade-interactive not showing minor updates on some packages

1 participant

@Ayush442842q